CSSDefinition.php 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565
  1. <?php
  2. /**
  3. * Defines allowed CSS attributes and what their values are.
  4. * @see HTMLPurifier_HTMLDefinition
  5. */
  6. class HTMLPurifier_CSSDefinition extends HTMLPurifier_Definition
  7. {
  8. public $type = 'CSS';
  9. /**
  10. * Assoc array of attribute name to definition object.
  11. * @type HTMLPurifier_AttrDef[]
  12. */
  13. public $info = [];
  14. /**
  15. * Constructs the info array. The meat of this class.
  16. * @param HTMLPurifier_Config $config
  17. */
  18. protected function doSetup($config)
  19. {
  20. $this->info['text-align'] = new HTMLPurifier_AttrDef_Enum(
  21. ['left', 'right', 'center', 'justify'],
  22. false
  23. );
  24. $border_style =
  25. $this->info['border-bottom-style'] =
  26. $this->info['border-right-style'] =
  27. $this->info['border-left-style'] =
  28. $this->info['border-top-style'] = new HTMLPurifier_AttrDef_Enum(
  29. [
  30. 'none',
  31. 'hidden',
  32. 'dotted',
  33. 'dashed',
  34. 'solid',
  35. 'double',
  36. 'groove',
  37. 'ridge',
  38. 'inset',
  39. 'outset'
  40. ],
  41. false
  42. );
  43. $this->info['border-style'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_style);
  44. $this->info['clear'] = new HTMLPurifier_AttrDef_Enum(
  45. ['none', 'left', 'right', 'both'],
  46. false
  47. );
  48. $this->info['float'] = new HTMLPurifier_AttrDef_Enum(
  49. ['none', 'left', 'right'],
  50. false
  51. );
  52. $this->info['font-style'] = new HTMLPurifier_AttrDef_Enum(
  53. ['normal', 'italic', 'oblique'],
  54. false
  55. );
  56. $this->info['font-variant'] = new HTMLPurifier_AttrDef_Enum(
  57. ['normal', 'small-caps'],
  58. false
  59. );
  60. $uri_or_none = new HTMLPurifier_AttrDef_CSS_Composite(
  61. [
  62. new HTMLPurifier_AttrDef_Enum(['none']),
  63. new HTMLPurifier_AttrDef_CSS_URI()
  64. ]
  65. );
  66. $this->info['list-style-position'] = new HTMLPurifier_AttrDef_Enum(
  67. ['inside', 'outside'],
  68. false
  69. );
  70. $this->info['list-style-type'] = new HTMLPurifier_AttrDef_Enum(
  71. [
  72. 'disc',
  73. 'circle',
  74. 'square',
  75. 'decimal',
  76. 'lower-roman',
  77. 'upper-roman',
  78. 'lower-alpha',
  79. 'upper-alpha',
  80. 'none'
  81. ],
  82. false
  83. );
  84. $this->info['list-style-image'] = $uri_or_none;
  85. $this->info['list-style'] = new HTMLPurifier_AttrDef_CSS_ListStyle($config);
  86. $this->info['text-transform'] = new HTMLPurifier_AttrDef_Enum(
  87. ['capitalize', 'uppercase', 'lowercase', 'none'],
  88. false
  89. );
  90. $this->info['color'] = new HTMLPurifier_AttrDef_CSS_Color();
  91. $this->info['background-image'] = $uri_or_none;
  92. $this->info['background-repeat'] = new HTMLPurifier_AttrDef_Enum(
  93. ['repeat', 'repeat-x', 'repeat-y', 'no-repeat']
  94. );
  95. $this->info['background-attachment'] = new HTMLPurifier_AttrDef_Enum(
  96. ['scroll', 'fixed']
  97. );
  98. $this->info['background-position'] = new HTMLPurifier_AttrDef_CSS_BackgroundPosition();
  99. $this->info['background-size'] = new HTMLPurifier_AttrDef_CSS_Composite(
  100. [
  101. new HTMLPurifier_AttrDef_Enum(
  102. [
  103. 'auto',
  104. 'cover',
  105. 'contain',
  106. ]
  107. ),
  108. new HTMLPurifier_AttrDef_CSS_Percentage(),
  109. new HTMLPurifier_AttrDef_CSS_Length()
  110. ]
  111. );
  112. $border_color =
  113. $this->info['border-top-color'] =
  114. $this->info['border-bottom-color'] =
  115. $this->info['border-left-color'] =
  116. $this->info['border-right-color'] =
  117. $this->info['background-color'] = new HTMLPurifier_AttrDef_CSS_Composite(
  118. [
  119. new HTMLPurifier_AttrDef_Enum(['transparent']),
  120. new HTMLPurifier_AttrDef_CSS_Color()
  121. ]
  122. );
  123. $this->info['background'] = new HTMLPurifier_AttrDef_CSS_Background($config);
  124. $this->info['border-color'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_color);
  125. $border_width =
  126. $this->info['border-top-width'] =
  127. $this->info['border-bottom-width'] =
  128. $this->info['border-left-width'] =
  129. $this->info['border-right-width'] = new HTMLPurifier_AttrDef_CSS_Composite(
  130. [
  131. new HTMLPurifier_AttrDef_Enum(['thin', 'medium', 'thick']),
  132. new HTMLPurifier_AttrDef_CSS_Length('0') //disallow negative
  133. ]
  134. );
  135. $this->info['border-width'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_width);
  136. $this->info['letter-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(
  137. [
  138. new HTMLPurifier_AttrDef_Enum(['normal']),
  139. new HTMLPurifier_AttrDef_CSS_Length()
  140. ]
  141. );
  142. $this->info['word-spacing'] = new HTMLPurifier_AttrDef_CSS_Composite(
  143. [
  144. new HTMLPurifier_AttrDef_Enum(['normal']),
  145. new HTMLPurifier_AttrDef_CSS_Length()
  146. ]
  147. );
  148. $this->info['font-size'] = new HTMLPurifier_AttrDef_CSS_Composite(
  149. [
  150. new HTMLPurifier_AttrDef_Enum(
  151. [
  152. 'xx-small',
  153. 'x-small',
  154. 'small',
  155. 'medium',
  156. 'large',
  157. 'x-large',
  158. 'xx-large',
  159. 'larger',
  160. 'smaller'
  161. ]
  162. ),
  163. new HTMLPurifier_AttrDef_CSS_Percentage(),
  164. new HTMLPurifier_AttrDef_CSS_Length()
  165. ]
  166. );
  167. $this->info['line-height'] = new HTMLPurifier_AttrDef_CSS_Composite(
  168. [
  169. new HTMLPurifier_AttrDef_Enum(['normal']),
  170. new HTMLPurifier_AttrDef_CSS_Number(true), // no negatives
  171. new HTMLPurifier_AttrDef_CSS_Length('0'),
  172. new HTMLPurifier_AttrDef_CSS_Percentage(true)
  173. ]
  174. );
  175. $margin =
  176. $this->info['margin-top'] =
  177. $this->info['margin-bottom'] =
  178. $this->info['margin-left'] =
  179. $this->info['margin-right'] = new HTMLPurifier_AttrDef_CSS_Composite(
  180. [
  181. new HTMLPurifier_AttrDef_CSS_Length(),
  182. new HTMLPurifier_AttrDef_CSS_Percentage(),
  183. new HTMLPurifier_AttrDef_Enum(['auto'])
  184. ]
  185. );
  186. $this->info['margin'] = new HTMLPurifier_AttrDef_CSS_Multiple($margin);
  187. // non-negative
  188. $padding =
  189. $this->info['padding-top'] =
  190. $this->info['padding-bottom'] =
  191. $this->info['padding-left'] =
  192. $this->info['padding-right'] = new HTMLPurifier_AttrDef_CSS_Composite(
  193. [
  194. new HTMLPurifier_AttrDef_CSS_Length('0'),
  195. new HTMLPurifier_AttrDef_CSS_Percentage(true)
  196. ]
  197. );
  198. $this->info['padding'] = new HTMLPurifier_AttrDef_CSS_Multiple($padding);
  199. $this->info['text-indent'] = new HTMLPurifier_AttrDef_CSS_Composite(
  200. [
  201. new HTMLPurifier_AttrDef_CSS_Length(),
  202. new HTMLPurifier_AttrDef_CSS_Percentage()
  203. ]
  204. );
  205. $trusted_wh = new HTMLPurifier_AttrDef_CSS_Composite(
  206. [
  207. new HTMLPurifier_AttrDef_CSS_Length('0'),
  208. new HTMLPurifier_AttrDef_CSS_Percentage(true),
  209. new HTMLPurifier_AttrDef_Enum(['auto'])
  210. ]
  211. );
  212. $trusted_min_wh = new HTMLPurifier_AttrDef_CSS_Composite(
  213. [
  214. new HTMLPurifier_AttrDef_CSS_Length('0'),
  215. new HTMLPurifier_AttrDef_CSS_Percentage(true),
  216. ]
  217. );
  218. $trusted_max_wh = new HTMLPurifier_AttrDef_CSS_Composite(
  219. [
  220. new HTMLPurifier_AttrDef_CSS_Length('0'),
  221. new HTMLPurifier_AttrDef_CSS_Percentage(true),
  222. new HTMLPurifier_AttrDef_Enum(['none'])
  223. ]
  224. );
  225. $max = $config->get('CSS.MaxImgLength');
  226. $this->info['width'] =
  227. $this->info['height'] =
  228. $max === null ?
  229. $trusted_wh :
  230. new HTMLPurifier_AttrDef_Switch(
  231. 'img',
  232. // For img tags:
  233. new HTMLPurifier_AttrDef_CSS_Composite(
  234. [
  235. new HTMLPurifier_AttrDef_CSS_Length('0', $max),
  236. new HTMLPurifier_AttrDef_Enum(['auto'])
  237. ]
  238. ),
  239. // For everyone else:
  240. $trusted_wh
  241. );
  242. $this->info['min-width'] =
  243. $this->info['min-height'] =
  244. $max === null ?
  245. $trusted_min_wh :
  246. new HTMLPurifier_AttrDef_Switch(
  247. 'img',
  248. // For img tags:
  249. new HTMLPurifier_AttrDef_CSS_Length('0', $max),
  250. // For everyone else:
  251. $trusted_min_wh
  252. );
  253. $this->info['max-width'] =
  254. $this->info['max-height'] =
  255. $max === null ?
  256. $trusted_max_wh :
  257. new HTMLPurifier_AttrDef_Switch(
  258. 'img',
  259. // For img tags:
  260. new HTMLPurifier_AttrDef_CSS_Composite(
  261. [
  262. new HTMLPurifier_AttrDef_CSS_Length('0', $max),
  263. new HTMLPurifier_AttrDef_Enum(['none'])
  264. ]
  265. ),
  266. // For everyone else:
  267. $trusted_max_wh
  268. );
  269. $this->info['aspect-ratio'] = new HTMLPurifier_AttrDef_CSS_Multiple(
  270. new HTMLPurifier_AttrDef_CSS_Composite([
  271. new HTMLPurifier_AttrDef_CSS_Ratio(),
  272. new HTMLPurifier_AttrDef_Enum(['auto']),
  273. ])
  274. );
  275. // text-decoration and related shorthands
  276. $this->info['text-decoration'] = new HTMLPurifier_AttrDef_CSS_TextDecoration();
  277. $this->info['text-decoration-line'] = new HTMLPurifier_AttrDef_Enum(
  278. ['none', 'underline', 'overline', 'line-through']
  279. );
  280. $this->info['text-decoration-style'] = new HTMLPurifier_AttrDef_Enum(
  281. ['solid', 'double', 'dotted', 'dashed', 'wavy']
  282. );
  283. $this->info['text-decoration-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  284. $this->info['text-decoration-thickness'] = new HTMLPurifier_AttrDef_CSS_Composite([
  285. new HTMLPurifier_AttrDef_CSS_Length(),
  286. new HTMLPurifier_AttrDef_CSS_Percentage(),
  287. new HTMLPurifier_AttrDef_Enum(['auto', 'from-font'])
  288. ]);
  289. $this->info['font-family'] = new HTMLPurifier_AttrDef_CSS_FontFamily();
  290. // this could use specialized code
  291. $this->info['font-weight'] = new HTMLPurifier_AttrDef_Enum(
  292. [
  293. 'normal',
  294. 'bold',
  295. 'bolder',
  296. 'lighter',
  297. '100',
  298. '200',
  299. '300',
  300. '400',
  301. '500',
  302. '600',
  303. '700',
  304. '800',
  305. '900'
  306. ],
  307. false
  308. );
  309. // MUST be called after other font properties, as it references
  310. // a CSSDefinition object
  311. $this->info['font'] = new HTMLPurifier_AttrDef_CSS_Font($config);
  312. // same here
  313. $this->info['border'] =
  314. $this->info['border-bottom'] =
  315. $this->info['border-top'] =
  316. $this->info['border-left'] =
  317. $this->info['border-right'] = new HTMLPurifier_AttrDef_CSS_Border($config);
  318. $this->info['border-collapse'] = new HTMLPurifier_AttrDef_Enum(
  319. ['collapse', 'separate']
  320. );
  321. $this->info['caption-side'] = new HTMLPurifier_AttrDef_Enum(
  322. ['top', 'bottom']
  323. );
  324. $this->info['table-layout'] = new HTMLPurifier_AttrDef_Enum(
  325. ['auto', 'fixed']
  326. );
  327. $this->info['vertical-align'] = new HTMLPurifier_AttrDef_CSS_Composite(
  328. [
  329. new HTMLPurifier_AttrDef_Enum(
  330. [
  331. 'baseline',
  332. 'sub',
  333. 'super',
  334. 'top',
  335. 'text-top',
  336. 'middle',
  337. 'bottom',
  338. 'text-bottom'
  339. ]
  340. ),
  341. new HTMLPurifier_AttrDef_CSS_Length(),
  342. new HTMLPurifier_AttrDef_CSS_Percentage()
  343. ]
  344. );
  345. $this->info['border-spacing'] = new HTMLPurifier_AttrDef_CSS_Multiple(new HTMLPurifier_AttrDef_CSS_Length(), 2);
  346. // These CSS properties don't work on many browsers, but we live
  347. // in THE FUTURE!
  348. $this->info['white-space'] = new HTMLPurifier_AttrDef_Enum(
  349. ['nowrap', 'normal', 'pre', 'pre-wrap', 'pre-line']
  350. );
  351. if ($config->get('CSS.Proprietary')) {
  352. $this->doSetupProprietary($config);
  353. }
  354. if ($config->get('CSS.AllowTricky')) {
  355. $this->doSetupTricky($config);
  356. }
  357. if ($config->get('CSS.Trusted')) {
  358. $this->doSetupTrusted($config);
  359. }
  360. $allow_important = $config->get('CSS.AllowImportant');
  361. // wrap all attr-defs with decorator that handles !important
  362. foreach ($this->info as $k => $v) {
  363. $this->info[$k] = new HTMLPurifier_AttrDef_CSS_ImportantDecorator($v, $allow_important);
  364. }
  365. $this->setupConfigStuff($config);
  366. }
  367. /**
  368. * @param HTMLPurifier_Config $config
  369. */
  370. protected function doSetupProprietary($config)
  371. {
  372. // Internet Explorer only scrollbar colors
  373. $this->info['scrollbar-arrow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  374. $this->info['scrollbar-base-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  375. $this->info['scrollbar-darkshadow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  376. $this->info['scrollbar-face-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  377. $this->info['scrollbar-highlight-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  378. $this->info['scrollbar-shadow-color'] = new HTMLPurifier_AttrDef_CSS_Color();
  379. // vendor specific prefixes of opacity
  380. $this->info['-moz-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
  381. $this->info['-khtml-opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
  382. // only opacity, for now
  383. $this->info['filter'] = new HTMLPurifier_AttrDef_CSS_Filter();
  384. // more CSS3
  385. $this->info['page-break-after'] =
  386. $this->info['page-break-before'] = new HTMLPurifier_AttrDef_Enum(
  387. [
  388. 'auto',
  389. 'always',
  390. 'avoid',
  391. 'left',
  392. 'right'
  393. ]
  394. );
  395. $this->info['page-break-inside'] = new HTMLPurifier_AttrDef_Enum(['auto', 'avoid']);
  396. $border_radius = new HTMLPurifier_AttrDef_CSS_Composite(
  397. [
  398. new HTMLPurifier_AttrDef_CSS_Percentage(true), // disallow negative
  399. new HTMLPurifier_AttrDef_CSS_Length('0') // disallow negative
  400. ]);
  401. $this->info['border-top-left-radius'] =
  402. $this->info['border-top-right-radius'] =
  403. $this->info['border-bottom-right-radius'] =
  404. $this->info['border-bottom-left-radius'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_radius, 2);
  405. // TODO: support SLASH syntax
  406. $this->info['border-radius'] = new HTMLPurifier_AttrDef_CSS_Multiple($border_radius, 4);
  407. }
  408. /**
  409. * @param HTMLPurifier_Config $config
  410. */
  411. protected function doSetupTricky($config)
  412. {
  413. $this->info['display'] = new HTMLPurifier_AttrDef_Enum(
  414. [
  415. 'inline',
  416. 'block',
  417. 'list-item',
  418. 'run-in',
  419. 'compact',
  420. 'marker',
  421. 'table',
  422. 'inline-block',
  423. 'inline-table',
  424. 'table-row-group',
  425. 'table-header-group',
  426. 'table-footer-group',
  427. 'table-row',
  428. 'table-column-group',
  429. 'table-column',
  430. 'table-cell',
  431. 'table-caption',
  432. 'none'
  433. ]
  434. );
  435. $this->info['visibility'] = new HTMLPurifier_AttrDef_Enum(
  436. ['visible', 'hidden', 'collapse']
  437. );
  438. $this->info['overflow'] = new HTMLPurifier_AttrDef_Enum(['visible', 'hidden', 'auto', 'scroll']);
  439. $this->info['opacity'] = new HTMLPurifier_AttrDef_CSS_AlphaValue();
  440. }
  441. /**
  442. * @param HTMLPurifier_Config $config
  443. */
  444. protected function doSetupTrusted($config)
  445. {
  446. $this->info['position'] = new HTMLPurifier_AttrDef_Enum(
  447. ['static', 'relative', 'absolute', 'fixed']
  448. );
  449. $this->info['top'] =
  450. $this->info['left'] =
  451. $this->info['right'] =
  452. $this->info['bottom'] = new HTMLPurifier_AttrDef_CSS_Composite(
  453. [
  454. new HTMLPurifier_AttrDef_CSS_Length(),
  455. new HTMLPurifier_AttrDef_CSS_Percentage(),
  456. new HTMLPurifier_AttrDef_Enum(['auto']),
  457. ]
  458. );
  459. $this->info['z-index'] = new HTMLPurifier_AttrDef_CSS_Composite(
  460. [
  461. new HTMLPurifier_AttrDef_Integer(),
  462. new HTMLPurifier_AttrDef_Enum(['auto']),
  463. ]
  464. );
  465. }
  466. /**
  467. * Performs extra config-based processing. Based off of
  468. * HTMLPurifier_HTMLDefinition.
  469. * @param HTMLPurifier_Config $config
  470. * @todo Refactor duplicate elements into common class (probably using
  471. * composition, not inheritance).
  472. */
  473. protected function setupConfigStuff($config)
  474. {
  475. // setup allowed elements
  476. $support = "(for information on implementing this, see the " .
  477. "support forums) ";
  478. $allowed_properties = $config->get('CSS.AllowedProperties');
  479. if ($allowed_properties !== null) {
  480. foreach ($this->info as $name => $d) {
  481. if (!isset($allowed_properties[$name])) {
  482. unset($this->info[$name]);
  483. }
  484. unset($allowed_properties[$name]);
  485. }
  486. // emit errors
  487. foreach ($allowed_properties as $name => $d) {
  488. // :TODO: Is this htmlspecialchars() call really necessary?
  489. $name = htmlspecialchars($name);
  490. trigger_error("Style attribute '$name' is not supported $support", E_USER_WARNING);
  491. }
  492. }
  493. $forbidden_properties = $config->get('CSS.ForbiddenProperties');
  494. if ($forbidden_properties !== null) {
  495. foreach ($this->info as $name => $d) {
  496. if (isset($forbidden_properties[$name])) {
  497. unset($this->info[$name]);
  498. }
  499. }
  500. }
  501. }
  502. }
  503. // vim: et sw=4 sts=4